Threat briefs

The Rapuncel infostealer campaign uses SEO-poisoned GitHub repositories to deliver malicious installers that deploy a kernel-level EDR killer to disable security products and harvest sensitive data.

An improper privilege management vulnerability in the UVdesk core-framework allows authenticated agents to escalate their privileges to administrator by manipulating the editAgent endpoint.

A vulnerability in the Python interpreter allows a remote, anonymous attacker to execute arbitrary code on affected systems.

The pg_partman extension for PostgreSQL is susceptible to multiple vulnerabilities allowing authenticated, remote attackers to perform Denial of Service, authorization bypass, and SQL injection, ultimately leading to privilege escalation and arbitrary command execution.

An unpatched, critical vulnerability in the D-Link DIR-822A router enables remote, unauthenticated attackers to execute arbitrary code on the target device.

A vulnerability in rsyslog allows a remote, unauthenticated attacker to cause a denial-of-service condition through improper handling of network inputs.

An authenticated remote attacker can exploit a vulnerability in Grafana to execute a Cross-Site Scripting (XSS) attack by injecting malicious scripts into the application.

A vulnerability in IBM Tape Library allows an authenticated remote attacker to cause a denial of service condition by sending specifically crafted requests.

An authenticated remote code execution vulnerability (CVE-2024-51751) in XWiki allows authenticated attackers to execute arbitrary code on the underlying host system.

An adversary linked to the Red Heron group is exploiting multiple vulnerabilities in WordPress, Ubiquiti, and ZyXEL devices to conduct reconnaissance, gain persistence, and exfiltrate sensitive records, including over 18,000 government documents.

Adversaries leverage 'for /f' loops within 'cmd.exe' to programmatically extract and process data from system command outputs for discovery and post-exploitation tasks.

A signature verification flaw in the noobaa-core component allows attackers to manipulate S3 presigned URLs, leading to unauthorized object copy operations and data access.

A vulnerability in the CRI-O container checkpoint and restore feature (CVE-2026-15801) allows an authenticated user to perform unauthorized host filesystem operations through insufficient metadata validation.

A vulnerability in CRI-O checkpoint restore allows an authenticated user to bypass Kubernetes security context enforcement by leveraging a malicious checkpointed container, leading to potential privilege escalation.

ComfyUI version 0.23.0 is vulnerable to unauthenticated remote code execution via unsafe deserialization of malicious pickle files.

A write-what-where vulnerability in the BSMEM64_W10.sys driver of the BioStar BIOS Update Utility 1.9.7.3 allows local attackers to achieve privilege escalation.

An unauthenticated remote SQL injection vulnerability in the Drogon framework ORM Mapper allows attackers to manipulate database queries via the sort parameter.

CVE-2026-94142 is a local privilege escalation vulnerability in the BioStar Temperature Monitor Utility driver BS_HWMIO64_W10.sys, allowing a local attacker to execute arbitrary code with kernel privileges via a write-what-where vulnerability.

An unauthenticated remote command injection vulnerability (CVE-2026-94139) in the Cookie Handler component of Feiyu Star Router allows attackers to execute arbitrary system commands via a manipulated session_id argument.

The North Korean threat actor Jade Sleet is conducting supply-chain attacks against DevOps engineers via malicious Terraform configurations that deploy Rust-based macOS backdoors.

CVE-2026-94129 is a local privilege escalation vulnerability in the BioStar VALKYRIE AURORA driver BS_RVSIO64.sys allowing arbitrary memory writes via an IOCTL handler.

A write-what-where vulnerability in the BS_LED64.sys driver of BioStar VIVID LED DJ 4.0.2411.1500 allows local users to achieve arbitrary memory writes and potential privilege escalation.

QCMS versions up to 6.0.6 are vulnerable to remote SQL injection via the ID argument in the self_Tmp function, allowing attackers to execute arbitrary database commands.

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the administrator account via crafted HTTP POST requests.

D-Link DIR-868L version 2.01b05 contains a critical stack-based buffer overflow vulnerability in the web authentication handler that allows unauthenticated remote code execution via malformed input.

The MCP project is vulnerable to remote path traversal exploitation via the create_file function in app/api/mcp/route.ts, allowing for unauthorized file manipulation.

A server-side request forgery (SSRF) vulnerability in the TaxHacker Invoice PDF Renderer allows remote attackers to perform unauthorized requests by manipulating the businessLogo argument.

A server-side request forgery vulnerability (CVE-2026-94038) in the NonceGeek dim-sum-app Deno backend allows remote attackers to manipulate the supabase_url parameter for unauthorized server-side requests.

D-Link DIR-X1860 and DIR-X1860Z routers are vulnerable to improper access control via the /ubus component in the routerd service, enabling local network attackers to exploit the passwd_set argument.

SourceCodester Drug Recommendation System 1.0 is vulnerable to remote SQL injection via the ID argument in /Admin/edit_symptom.php, allowing unauthenticated attackers to manipulate backend database queries.